Intrusion detection method and system for work station

Abstract

The invention discloses an intrusion detection method for a work station, which comprises the following steps: the work station establishes a trusted device list for storing names and IP addresses of trusted devices, respectively creates digital tokens for different trusted devices, and issues the digital tokens to the corresponding trusted devices; when the access equipment does not hold the digital token to request to access the workstation, the workstation refuses the request of the access equipment, and when the access equipment holds the digital token to request to access the workstation, the access equipment requests to the workstation to verify whether the name and the IP address of the access equipment are in the trusted equipment list; and when the access device accesses the workstation, the workstation monitors the SQL statement to be executed and the file read-write operation performed by the access device in real time. According to the method, a complicated calculation process is avoided, the occupation of calculation resources of the workstation is small, the data processing speed of the acquisition workstation is not influenced, and the identity verification of the workstation on the access equipment is realized by issuing and verifying the digital token.

Description

Technical Field

[0001] The present invention relates to the field of network technology, and in particular to an intrusion detection method and system for a workstation. Background Art

[0002] With the development of society, the law enforcement instrument is an important part of the law enforcement information system and also an on-site recording device for law enforcement in the safety supervision system. In the process of case handling, through the on-site audio and video data collection, transmission and storage, the law enforcement situation of law enforcement personnel can be remotely and real-timely monitored and managed. The on-site audio and video data transmission and storage depends on the normal operation of the collection workstation. It is very necessary to ensure the safety of the collection workstation and detect illegal intrusions on the collection workstation.

[0003] However, existing anti-virus software and firewall software will consume the computing resources of the workstation and affect the speed of data processing of the collection workstation. In addition, the existing related methods lack the identity verification link for body cameras and other devices that perform daily access to the workstation. Summary of the invention

[0004] In view of the above-mentioned technical deficiencies, the purpose of the present invention is to provide an intrusion detection method and system for a workstation, aiming to solve the problem that existing anti-virus software and firewall software consume the computing resources of the workstation and affect the speed of data processing at the collection workstation, and the existing related methods lack the identity verification link for law enforcement instruments and other devices that perform daily access to the workstation.

[0005] In view of the above problems, the present application provides an intrusion detection method and system for a workstation.

[0006] The first aspect disclosed in the present application provides an intrusion detection method for a workstation, the method comprising: The workstation establishes a trusted device list to store the names and IP addresses of trusted devices, creates digital tokens for different trusted devices, and issues them to the corresponding trusted devices; When an access device without a digital token requests to access a workstation, the workstation rejects the access device's request. If the access device continuously requests to access the workstation without interruption and the access request frequency exceeds a preset threshold, the access device is determined to be a dangerous device and the workstation is prohibited from establishing any connection with the access device. When an access device holds a digital token and requests to access a workstation, the access device requests the workstation to verify whether the name and IP address of the access device are in the list of trusted devices: if the name and IP address of the access device are not in the list of trusted devices, the workstation rejects the access device's request; if the access device continues to request to access the workstation and requests verification from the workstation after the workstation rejects the request, and the frequency of the access request exceeds a preset threshold, the access device is determined to be a dangerous device, and the workstation is prohibited from establishing any connection with the access device; if the name and IP address of the access device are in the list of trusted devices, the access device requests the workstation to verify whether the digital token is authentic; if the digital token is not authentic, the workstation rejects the access device's request; if the access device continues to request to verify the digital token after the workstation rejects the request, and the frequency of the request exceeds a preset threshold, the access device is determined to be a dangerous device, and the workstation is prohibited from establishing any connection with the access device; if the digital token is authentic, the access device is determined to be a trusted device, and the workstation accepts access by the access device; When the access device accesses the workstation, the workstation monitors the SQL statement to be executed by the access device in real time, and regards the SQL statement as a section. If the type of the SQL statement to be executed is a non-data query language, the SQL statement to be executed is intercepted facing the section, wherein the non-data query language includes data definition language, data operation language, data control language and transaction control language; When an access device accesses a workstation, the workstation monitors the file read and write operations performed by the access device on the storage medium on the workstation in real time, prohibits the access device from executing or creating executable files on the workstation, and prohibits the access device from modifying or deleting all files owned by the workstation or other access devices.

[0007] Preferably, the creation of the digital token comprises the following steps: Get the name and IP address of the trusted device, convert the above two pieces of information into JSON format, and generate a JSON object; Encode the JSON object using the Base64 encoding algorithm to generate an encoded string; Performing an encryption operation on the encoded string using a private key of an RSA algorithm to generate an encrypted string, wherein the private key is stored in a workstation; Concatenate the encoded string and the encrypted string together to generate a digital token.

[0008] Preferably, the workstation is prohibited from establishing any connection with the access device, including: Establish an IP address blacklist to store the IP addresses of devices that are judged to be dangerous devices; Add the IP address from the access device to the IP address blacklist; Prohibit the IP addresses in the IP address blacklist from establishing TCP or UDP connections with the workstation.

[0009] Preferably, when the access device holds a digital token and requests to access a workstation, the access device requests the workstation to verify whether the name and IP address of the access device are in a list of trusted devices, including: When the access device holds the digital token and requests to access the workstation, the workstation extracts the encoded string portion of the digital token, performs a decoding operation through the Base64 encoding algorithm, and restores the JSON object; If decoding fails or recovery of the JSON object fails, the workstation denies the request to access the device; The device name and IP address in the JSON object are extracted, and compared with the trusted device names and IP addresses stored in the trusted device list to determine whether the name and IP address of the access device are in the trusted device list.

[0010] Preferably, the access device requests the workstation to verify whether the digital token is authentic, comprising: The workstation extracts the encrypted string portion of the digital token, performs a decryption operation using the public key of the RSA algorithm, compares the decrypted result with the encoded string portion of the digital token, and verifies the authenticity of the digital token by comparing whether the results are completely consistent.

[0011] A second aspect disclosed in the present application provides an intrusion detection system for a workstation, the system being used in the above-mentioned intrusion detection method for a workstation, the system comprising: A preset module, which is used for the workstation to establish a trusted device list, to store the names and IP addresses of the trusted devices, to create digital tokens for different trusted devices, and to issue them to the corresponding trusted devices; A first verification module, wherein the first verification module is used for, when an access device without a digital token requests to access a workstation, the workstation rejects the access device's request, and if the access device continuously requests to access the workstation without interruption and the access request frequency exceeds a preset threshold, the access device is determined to be a dangerous device, and the workstation is prohibited from establishing any connection with the access device; A second verification module, which is used for when an access device holds a digital token and requests to access a workstation, the access device requests the workstation to verify whether the name and IP address of the access device are in the list of trusted devices: if the name and IP address of the access device are not in the list of trusted devices, the workstation rejects the request of the access device; if the access device continues to continuously request to access the workstation and requests verification from the workstation after the request is rejected by the workstation, and the frequency of the access request exceeds a preset threshold, the access device is determined to be a dangerous device, and the workstation is prohibited from establishing any connection with the access device; if the name and IP address of the access device are in the list of trusted devices, the access device requests the workstation to verify whether the digital token is authentic; if the digital token is not authentic, the workstation rejects the request of the access device; if the access device continues to continuously request to verify the digital token after the request is rejected by the workstation, and the frequency of the request exceeds a preset threshold, the access device is determined to be a dangerous device, and the workstation is prohibited from establishing any connection with the access device; if the digital token is authentic, the access device is determined to be a trusted device, and the workstation accepts access by the access device; SQL monitoring module, wherein when an access device accesses a workstation, the workstation monitors the SQL statement to be executed by the access device in real time, and regards the SQL statement as a section. If the type of the SQL statement to be executed is a non-data query language, the SQL statement to be executed is intercepted for the section, wherein the non-data query language includes a data definition language, a data manipulation language, a data control language, and a transaction control language; A file monitoring module is used when an access device accesses a workstation. The workstation monitors the file read and write operations performed by the access device on the storage medium on the workstation in real time, prohibits the access device from executing or creating executable files on the workstation, and prohibits the access device from modifying or deleting all files owned by the workstation or other access devices.

[0012] The third aspect disclosed in the present application provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above-mentioned intrusion detection method for a workstation when executing the computer program.

[0013] A fourth aspect disclosed in the present application provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the steps of the above-mentioned intrusion detection method for a workstation are implemented.

[0014] The fifth aspect disclosed in the present application provides a computer program product, including a computer program or instructions, which, when executed by a processor, implement the steps of the above-mentioned intrusion detection method for a workstation.

[0015] The beneficial effects of the present invention are: (1) There is no complicated calculation process, which occupies very little computing resources of the workstation and does not affect the data processing speed of the acquisition workstation.

[0016] (2) By identifying devices whose access frequency or request frequency exceeds a preset threshold as dangerous devices and prohibiting them from establishing connections, some denial of service attacks can be defended.

[0017] (3) Through the issuance and verification of digital tokens, the workstation can authenticate the access device and prevent identity fraud by binding the device name and IP address.

[0018] (4) Ensure the security of the workstation database by monitoring the execution of SQL statements through aspect-oriented monitoring. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 The figure is an overall flow chart of an intrusion detection method for a workstation.

[0021] Figure 2 The figure is an overall structural diagram of an intrusion detection system for workstations. DETAILED DESCRIPTION

[0022] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0023] like Figure 1 As shown, an embodiment of the present application provides an intrusion detection method for a workstation, the method comprising the following steps: The workstation establishes a trusted device list to store the names and IP addresses of trusted devices, creates digital tokens for different trusted devices, and issues them to the corresponding trusted devices; When an access device without a digital token requests to access a workstation, the workstation rejects the access device's request. If the access device continuously requests to access the workstation without interruption and the access request frequency exceeds a preset threshold, the access device is determined to be a dangerous device and the workstation is prohibited from establishing any connection with the access device. When an access device holds a digital token and requests to access a workstation, the access device requests the workstation to verify whether the name and IP address of the access device are in the list of trusted devices: if the name and IP address of the access device are not in the list of trusted devices, the workstation rejects the access device's request; if the access device continues to request to access the workstation and requests verification from the workstation after the workstation rejects the request, and the frequency of the access request exceeds a preset threshold, the access device is determined to be a dangerous device, and the workstation is prohibited from establishing any connection with the access device; if the name and IP address of the access device are in the list of trusted devices, the access device requests the workstation to verify whether the digital token is authentic; if the digital token is not authentic, the workstation rejects the access device's request; if the access device continues to request to verify the digital token after the workstation rejects the request, and the frequency of the request exceeds a preset threshold, the access device is determined to be a dangerous device, and the workstation is prohibited from establishing any connection with the access device; if the digital token is authentic, the access device is determined to be a trusted device, and the workstation accepts access by the access device; When the access device accesses the workstation, the workstation monitors the SQL statement to be executed by the access device in real time, and regards the SQL statement as a section. If the type of the SQL statement to be executed is a non-data query language, the SQL statement to be executed is intercepted facing the section, wherein the non-data query language includes data definition language, data operation language, data control language and transaction control language; When an access device accesses a workstation, the workstation monitors the file read and write operations performed by the access device on the storage medium on the workstation in real time, prohibits the access device from executing or creating executable files on the workstation, and prohibits the access device from modifying or deleting all files owned by the workstation or other access devices.

[0024] Furthermore, the creation of the digital token comprises the following steps: Get the name and IP address of the trusted device, convert the above two pieces of information into JSON format, and generate a JSON object; Encode the JSON object using the Base64 encoding algorithm to generate an encoded string; Performing an encryption operation on the encoded string using a private key of an RSA algorithm to generate an encrypted string, wherein the private key is stored in a workstation; Concatenate the encoded string and the encrypted string together to generate a digital token.

[0025] Specifically, other information used to verify the identity of the device can also be stored in the JSON object. However, since Base64 encoding has no encryption function, other private information should not be stored in the JSON object. In addition, using the private key of the RSA algorithm for encryption is equivalent to the workstation's digital signature on the issued digital token, which can ensure the digital token's non-tamperability and non-forgeability.

[0026] Furthermore, the workstation is prohibited from establishing any connection with the access device, including: Establish an IP address blacklist to store the IP addresses of devices that are judged to be dangerous devices; Add the IP address from the access device to the IP address blacklist; Prohibit the IP addresses in the IP address blacklist from establishing TCP or UDP connections with the workstation.

[0027] Specifically, by prohibiting the IP addresses in the IP address blacklist from establishing TCP connections or UDP connections with the workstation, some denial of service attacks can be prevented.

[0028] Furthermore, when the access device holds the digital token and requests to access the workstation, the access device requests the workstation to verify whether the name and IP address of the access device are in the trusted device list, including: When the access device holds the digital token and requests to access the workstation, the workstation extracts the encoded string portion of the digital token, performs a decoding operation through the Base64 encoding algorithm, and restores the JSON object; If decoding fails or recovery of the JSON object fails, the workstation denies the request to access the device; The device name and IP address in the JSON object are extracted, and compared with the trusted device names and IP addresses stored in the trusted device list to determine whether the name and IP address of the access device are in the trusted device list.

[0029] Furthermore, the access device requests the workstation to verify whether the digital token is authentic, including: The workstation extracts the encrypted string portion of the digital token, performs a decryption operation using the public key of the RSA algorithm, compares the decrypted result with the encoded string portion of the digital token, and verifies the authenticity of the digital token by comparing whether the results are completely consistent.

[0030] Specifically, the public key of the RSA algorithm is used to perform a decryption operation, and the decryption result is compared with the encoded string part of the digital token, which is equivalent to verifying the legitimacy of the digital signature to ensure that the digital token has not been tampered with.

[0031] In summary, the intrusion detection method for a workstation provided by the embodiment of the present application has the following technical effects: (1) There is no complicated calculation process, which occupies very little computing resources of the workstation and does not affect the data processing speed of the acquisition workstation.

[0032] (2) By identifying devices whose access frequency or request frequency exceeds a preset threshold as dangerous devices and prohibiting them from establishing connections, some denial of service attacks can be defended.

[0033] (3) Through the issuance and verification of digital tokens, the workstation can authenticate the access device and prevent identity fraud by binding the device name and IP address.

[0034] (4) Ensure the security of the workstation database by monitoring the execution of SQL statements through aspect-oriented monitoring.

[0035] Based on the same inventive concept as the intrusion detection method for a workstation in the aforementioned embodiment, Figure 2 As shown, the present application provides an intrusion detection system for a workstation, the system comprising: A preset module, which is used for the workstation to establish a trusted device list, to store the names and IP addresses of the trusted devices, to create digital tokens for different trusted devices, and to issue them to the corresponding trusted devices; A first verification module, wherein the first verification module is used for, when an access device without a digital token requests to access a workstation, the workstation rejects the access device's request, and if the access device continuously requests to access the workstation without interruption and the access request frequency exceeds a preset threshold, the access device is determined to be a dangerous device, and the workstation is prohibited from establishing any connection with the access device; A second verification module, which is used for when an access device holds a digital token and requests to access a workstation, the access device requests the workstation to verify whether the name and IP address of the access device are in the list of trusted devices: if the name and IP address of the access device are not in the list of trusted devices, the workstation rejects the request of the access device; if the access device continues to continuously request to access the workstation and requests verification from the workstation after the request is rejected by the workstation, and the frequency of the access request exceeds a preset threshold, the access device is determined to be a dangerous device, and the workstation is prohibited from establishing any connection with the access device; if the name and IP address of the access device are in the list of trusted devices, the access device requests the workstation to verify whether the digital token is authentic; if the digital token is not authentic, the workstation rejects the request of the access device; if the access device continues to continuously request to verify the digital token after the request is rejected by the workstation, and the frequency of the request exceeds a preset threshold, the access device is determined to be a dangerous device, and the workstation is prohibited from establishing any connection with the access device; if the digital token is authentic, the access device is determined to be a trusted device, and the workstation accepts access by the access device; SQL monitoring module, wherein when an access device accesses a workstation, the workstation monitors the SQL statement to be executed by the access device in real time, and regards the SQL statement as a section. If the type of the SQL statement to be executed is a non-data query language, the SQL statement to be executed is intercepted for the section, wherein the non-data query language includes a data definition language, a data manipulation language, a data control language, and a transaction control language; A file monitoring module is used when an access device accesses a workstation. The workstation monitors the file read and write operations performed by the access device on the storage medium on the workstation in real time, prohibits the access device from executing or creating executable files on the workstation, and prohibits the access device from modifying or deleting all files owned by the workstation or other access devices.

[0036] Through the above detailed description of an intrusion detection method for a workstation, those skilled in the art can clearly understand an intrusion detection system for a workstation in this embodiment. Since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0037] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above-mentioned intrusion detection method for a workstation when executing the computer program.

[0038] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned intrusion detection method for a workstation are implemented.

[0039] In one embodiment, a computer program product is provided, including a computer program or instructions, wherein when the computer program or instructions are executed by a processor, the steps of the above-mentioned intrusion detection method for a workstation are implemented.

[0040] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0041] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for intrusion detection of a workstation, characterized in that: The method comprises: The workstation establishes a trusted device list to store the names and IP addresses of trusted devices, creates digital tokens for different trusted devices, and issues them to the corresponding trusted devices; When an access device without a digital token requests to access a workstation, the workstation rejects the access device's request. If the access device continuously requests to access the workstation without interruption and the access request frequency exceeds a preset threshold, the access device is determined to be a dangerous device and the workstation is prohibited from establishing any connection with the access device. When an access device holds a digital token and requests to access a workstation, the access device requests the workstation to verify whether the name and IP address of the access device are in the list of trusted devices: if the name and IP address of the access device are not in the list of trusted devices, the workstation rejects the access device's request; if the access device continues to request to access the workstation and requests verification from the workstation after the workstation rejects the request, and the frequency of the access request exceeds a preset threshold, the access device is determined to be a dangerous device, and the workstation is prohibited from establishing any connection with the access device; if the name and IP address of the access device are in the list of trusted devices, the access device requests the workstation to verify whether the digital token is authentic; if the digital token is not authentic, the workstation rejects the access device's request; if the access device continues to request to verify the digital token after the workstation rejects the request, and the frequency of the request exceeds a preset threshold, the access device is determined to be a dangerous device, and the workstation is prohibited from establishing any connection with the access device; if the digital token is authentic, the access device is determined to be a trusted device, and the workstation accepts access by the access device; When the access device accesses the workstation, the workstation monitors the SQL statement to be executed by the access device in real time, and regards the SQL statement as a section. If the type of the SQL statement to be executed is a non-data query language, the SQL statement to be executed is intercepted facing the section, wherein the non-data query language includes data definition language, data operation language, data control language and transaction control language; When an access device accesses a workstation, the workstation monitors the file read and write operations performed by the access device on the storage medium on the workstation in real time, prohibits the access device from executing or creating executable files on the workstation, and prohibits the access device from modifying or deleting all files owned by the workstation or other access devices.

2. The intrusion detection method for a workstation according to claim 1, characterized in that: The creation of the digital token comprises the following steps: Get the name and IP address of the trusted device, convert the above two pieces of information into JSON format, and generate a JSON object; Encode the JSON object using the Base64 encoding algorithm to generate an encoded string; Performing an encryption operation on the encoded string using a private key of an RSA algorithm to generate an encrypted string, wherein the private key is stored in a workstation; Concatenate the encoded string and the encrypted string together to generate a digital token.

3. The intrusion detection method for a workstation as claimed in claim 2, characterized in that: The workstation is prohibited from establishing any connection with the access device, including: Establish an IP address blacklist to store the IP addresses of devices that are judged to be dangerous devices; Add the IP address from the access device to the IP address blacklist; Prohibit the IP addresses in the IP address blacklist from establishing TCP or UDP connections with the workstation.

4. The intrusion detection method for a workstation as claimed in claim 3, characterized in that: When the access device holds the digital token and requests to access the workstation, the access device requests the workstation to verify whether the name and IP address of the access device are in the trusted device list, including: When the access device holds the digital token and requests to access the workstation, the workstation extracts the encoded string portion of the digital token, performs a decoding operation through the Base64 encoding algorithm, and restores the JSON object; If decoding fails or recovery of the JSON object fails, the workstation denies the request to access the device; The device name and IP address in the JSON object are extracted, and compared with the trusted device names and IP addresses stored in the trusted device list to determine whether the name and IP address of the access device are in the trusted device list.

5. The intrusion detection method for a workstation as claimed in claim 4, characterized in that: The access device requests the workstation to verify whether the digital token is authentic, including: The workstation extracts the encrypted string portion of the digital token, performs a decryption operation using the public key of the RSA algorithm, compares the decrypted result with the encoded string portion of the digital token, and verifies the authenticity of the digital token by comparing whether the results are completely consistent.

6. An intrusion detection system for a workstation, the system comprising: A preset module, which is used for the workstation to establish a trusted device list, to store the names and IP addresses of the trusted devices, to create digital tokens for different trusted devices, and to issue them to the corresponding trusted devices; A first verification module, wherein the first verification module is used for, when an access device without a digital token requests to access a workstation, the workstation rejects the access device's request, and if the access device continuously requests to access the workstation without interruption and the access request frequency exceeds a preset threshold, the access device is determined to be a dangerous device, and the workstation is prohibited from establishing any connection with the access device; A second verification module, which is used for when an access device holds a digital token and requests to access a workstation, the access device requests the workstation to verify whether the name and IP address of the access device are in the list of trusted devices: if the name and IP address of the access device are not in the list of trusted devices, the workstation rejects the request of the access device; if the access device continues to continuously request to access the workstation and requests verification from the workstation after the request is rejected by the workstation, and the frequency of the access request exceeds a preset threshold, the access device is determined to be a dangerous device, and the workstation is prohibited from establishing any connection with the access device; if the name and IP address of the access device are in the list of trusted devices, the access device requests the workstation to verify whether the digital token is authentic; if the digital token is not authentic, the workstation rejects the request of the access device; if the access device continues to continuously request to verify the digital token after the request is rejected by the workstation, and the frequency of the request exceeds a preset threshold, the access device is determined to be a dangerous device, and the workstation is prohibited from establishing any connection with the access device; if the digital token is authentic, the access device is determined to be a trusted device, and the workstation accepts access by the access device; SQL monitoring module, wherein when an access device accesses a workstation, the workstation monitors the SQL statement to be executed by the access device in real time, and regards the SQL statement as a section. If the type of the SQL statement to be executed is a non-data query language, the SQL statement to be executed is intercepted for the section, wherein the non-data query language includes a data definition language, a data manipulation language, a data control language, and a transaction control language; A file monitoring module is used when an access device accesses a workstation. The workstation monitors the file read and write operations performed by the access device on the storage medium on the workstation in real time, prohibits the access device from executing or creating executable files on the workstation, and prohibits the access device from modifying or deleting all files owned by the workstation or other access devices.

7. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of an intrusion detection method for a workstation described in any one of claims 1 to 5 are implemented.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of an intrusion detection method for a workstation according to any one of claims 1 to 5 are implemented.

9. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the steps of an intrusion detection method for a workstation described in any one of claims 1 to 5 are implemented.

Images